Bug 1623679

Verified on:

version:
ipa-server-4.5.4-10.el7_5.4.4.x86_64

Steps:
1) Install master with CA
2) Install replica1 without CA
3) Stop ipa-custodia on replica1
   $  systemctl stop ipa-custodia.service
4) Install replica2 from replica1. Since replica1 doesn't have a CA, the installer on replica2 will fetch all secrets from master.

Actual result:

replica2 installed successfully from replica1.

Master - vm-171-027
~~~~~~

[root@vm-171-027 ~]# tail -1f /var/log/ipaserver-install.log 
2018-09-11T15:28:55Z INFO The ipa-server-install command was successful

Replica1 - vm-189
~~~~~~~~

[root@vm-189 ~]# tail -1f /var/log/ipareplica-install.log
2018-09-11T15:36:38Z INFO The ipa-replica-install command was successful
^C
[root@vm-189 ~]# 
[root@vm-189 ~]# ipactl status
Directory Service: RUNNING
krb5kdc Service: RUNNING
kadmin Service: RUNNING
httpd Service: RUNNING
ipa-custodia Service: STOPPED
ntpd Service: RUNNING
ipa-otpd Service: RUNNING
ipa: INFO: The ipactl command was successful
[root@vm-189 ~]# 


Replica2 - vm-057
~~~~~~~~

[root@vm-057 ~]# ipa-replica-install -U --setup-dns --forwarder 10.37.170.1 --no-reverse --setup-ca --server vm-189.ipa.test --domain IPA.TEST --admin-password Secret123 --principal admin
WARNING: conflicting time&date synchronization service 'chronyd' will
be disabled in favor of ntpd

Configuring client side components
Client hostname: vm-057.ipa.test
Realm: IPA.TEST
DNS Domain: IPA.TEST
IPA Server: vm-189.ipa.test
BaseDN: dc=dom-171-027,dc=ipa,dc=test

Skipping synchronizing time with NTP server.
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=IPA.TEST
    Issuer:      CN=Certificate Authority,O=IPA.TEST
    Valid From:  2018-09-11 15:24:07
    Valid Until: 2038-09-11 15:24:07

Enrolled in IPA realm IPA.TEST
Created /etc/ipa/default.conf
New SSSD config will be created
Configured sudoers in /etc/nsswitch.conf
Configured /etc/sssd/sssd.conf
Configured /etc/krb5.conf for IPA realm IPA.TEST
trying https://vm-189.ipa.test/ipa/json
[try 1]: Forwarding 'schema' to json server 'https://vm-189.ipa.test/ipa/json'
trying https://vm-189.ipa.test/ipa/session/json
[try 1]: Forwarding 'ping' to json server 'https://vm-189.ipa.test/ipa/session/json'
[try 1]: Forwarding 'ca_is_enabled' to json server 'https://vm-189.ipa.test/ipa/session/json'
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
[try 1]: Forwarding 'host_mod' to json server 'https://vm-189.ipa.test/ipa/session/json'
Could not update DNS SSHFP records.
SSSD enabled
Configured /etc/openldap/ldap.conf
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config
Configuring IPA.TEST as NIS domain.
Client configuration complete.
The ipa-client-install command was successful

Checking DNS forwarders, please wait ...
Run connection check to master
Connection check OK
Configuring NTP daemon (ntpd)
  [1/4]: stopping ntpd
  [2/4]: writing configuration
  [3/4]: configuring ntpd to start on boot
...
...
...
  [4/7]: setting up SoftHSM
  [5/7]: adding DNSSEC containers
  [6/7]: creating replica keys
  [7/7]: configuring ipa-dnskeysyncd to start on boot
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
Updating DNS system records

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

[root@vm-057 ~]# 
[root@vm-057 ~]# ipa server-role-find
-----------------------
18 server roles matched
-----------------------
  Server name: vm-057.ipa.test
  Role name: CA server
  Role status: enabled

  Server name: vm-171-027.ipa.test
  Role name: CA server
  Role status: enabled

  Server name: vm-189.ipa.test
  Role name: CA server
  Role status: absent

  Server name: vm-057.ipa.test
  Role name: DNS server
  Role status: enabled

  Server name: vm-171-027.ipa.test
  Role name: DNS server
  Role status: enabled

  Server name: vm-189.ipa.test
  Role name: DNS server
  Role status: absent

  Server name: vm-057.ipa.test
  Role name: NTP server
  Role status: enabled

  Server name: vm-171-027.ipa.test
  Role name: NTP server
  Role status: enabled

  Server name: vm-189.ipa.test
  Role name: NTP server
  Role status: enabled

  Server name: vm-057.ipa.test
  Role name: AD trust agent
  Role status: absent

  Server name: vm-171-027.ipa.test
  Role name: AD trust agent
  Role status: absent

  Server name: vm-189.ipa.test
  Role name: AD trust agent
  Role status: absent

  Server name: vm-057.ipa.test
  Role name: KRA server
  Role status: absent

  Server name: vm-171-027.ipa.test
  Role name: KRA server
  Role status: absent

  Server name: vm-189.ipa.test
  Role name: KRA server
  Role status: absent

  Server name: vm-057.ipa.test
  Role name: AD trust controller
  Role status: absent

  Server name: vm-171-027.ipa.test
  Role name: AD trust controller
  Role status: absent

  Server name: vm-189.ipa.test
  Role name: AD trust controller
  Role status: absent
-----------------------------
Number of entries returned 18
-----------------------------
[root@vm-057 ~]#

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:2760